1b2402b5e7659024d3ce8a7e30d63f587ed80d08137ad665e0668ea5dff3ea60_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1b2402b5e7659024d3ce8a7e30d63f587ed80d08137ad665e0668ea5dff3ea60_NeikiAnalytics.exe
Size

183KB
MD5

5e84afe0bb864b3883009cc37c334b30
SHA1

f2eaf8b189f0a05c8934f1d101f408600e86440e
SHA256

1b2402b5e7659024d3ce8a7e30d63f587ed80d08137ad665e0668ea5dff3ea60
SHA512

a5c82369fc57a315f4de56853c773a0a46503530892c80152e5f9e93dfb13b441343973c884327306b5e0545a60bb0115f77ef6daf197eb56ff365e872d91c05
SSDEEP

3072:ozYie7/I43fbJOF+SQh/gGyHoyiSBgwyBM0xdL5sWmr:tZ7/vJOF+SQh/kHoyiSQMiL5sh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b2402b5e7659024d3ce8a7e30d63f587ed80d08137ad665e0668ea5dff3ea60_NeikiAnalytics.exe

Files

1b2402b5e7659024d3ce8a7e30d63f587ed80d08137ad665e0668ea5dff3ea60_NeikiAnalytics.exe
.exe windows:6 windows x86 arch:x86

c0d741cff39048e39472c2ece7abf74b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

log4cxx

??0LocationInfo@spi@log4cxx@@QAE@QBD0H@Z
?forcedLog@Logger@log4cxx@@QBEXABV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVLocationInfo@spi@2@@Z
??1MessageBuffer@helpers@log4cxx@@QAE@XZ
??0MessageBuffer@helpers@log4cxx@@QAE@XZ
?isDebugEnabled@Logger@log4cxx@@QBE_NXZ
?str@MessageBuffer@helpers@log4cxx@@QAEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVCharMessageBuffer@23@@Z
??6MessageBuffer@helpers@log4cxx@@QAEAAVCharMessageBuffer@12@PAD@Z
?getDebug@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
?isInfoEnabled@Logger@log4cxx@@QBE_NXZ
?getInfo@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
?isWarnEnabled@Logger@log4cxx@@QBE_NXZ
?getWarn@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
?isErrorEnabled@Logger@log4cxx@@QBE_NXZ
??1?$ObjectPtrT@VLogger@log4cxx@@@helpers@log4cxx@@UAE@XZ
??1?$ObjectPtrT@VLevel@log4cxx@@@helpers@log4cxx@@UAE@XZ
??1File@log4cxx@@QAE@XZ
??0File@log4cxx@@QAE@PBD@Z
?configure@PropertyConfigurator@log4cxx@@SAXABVFile@2@@Z
?getError@Level@log4cxx@@SA?AV?$ObjectPtrT@VLevel@log4cxx@@@helpers@2@XZ
?getLogger@Logger@log4cxx@@SA?AV?$ObjectPtrT@VLogger@log4cxx@@@helpers@2@QBD@Z

mfc110

ord1498
ord316
ord1038
ord4746
ord4256
ord12361
ord4978
ord987
ord1459
ord2352
ord1517
ord2931
ord14100
ord12538
ord1500

msvcr110

malloc
strrchr
fgets
fread
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
strncat_s
_endthread
_beginthreadex
printf
memset
exit
sprintf_s
_errno
fopen_s
fclose
fwrite
isspace
vsprintf_s
_purecall
strstr
strncpy_s
_gmtime64_s
strncmp
_localtime64_s
_time64
strchr
strcpy_s
atoi
memmove
_CxxThrowException
__CxxFrameHandler3
memcpy
free

kernel32

GetLocalTime
GetModuleHandleA
GetCommandLineA
Sleep
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
SetConsoleCtrlHandler

user32

PeekMessageA
PostThreadMessageA

msvcp110

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Winerror_map@std@@YAPBDH@Z

odbc32

ord31
ord8
ord9
ord24
ord29
ord11
ord36
ord75
ord39
ord7
ord13
ord43

ws2_32

setsockopt
socket
closesocket
__WSAFDIsSet
bind
listen
accept
htonl
send
sendto
select
recv
WSAStartup
htons
ioctlsocket
connect
inet_addr

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c0d741cff39048e39472c2ece7abf74b

Headers

DLL Characteristics

File Characteristics

Imports

log4cxx

mfc110

msvcr110

kernel32

user32

msvcp110

odbc32

ws2_32

Sections

.text Size: 131KB - Virtual size: 130KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 512B - Virtual size: 176KB

.rsrc Size: 1024B - Virtual size: 752B

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 131KB - Virtual size: 130KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 512B - Virtual size: 176KB

.rsrc
Size: 1024B - Virtual size: 752B

.reloc
Size: 14KB - Virtual size: 13KB